You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
81 lines
3.1 KiB
81 lines
3.1 KiB
3 years ago
|
From 7f5b0778fa301b68c1c88e3820ec3afbd09dd0a5 Mon Sep 17 00:00:00 2001
|
||
|
|
From: clanmills <robin@clanmills.com>
|
||
|
|
Date: Wed, 27 Sep 2017 09:20:13 +0100
|
||
|
|
Subject: Fix https://github.com/Exiv2/exiv2/issues/55
|
||
|
|
|
||
|
|
(cherry picked from commit 6e3855aed7ba8bb4731fc4087ca7f9078b2f3d97)
|
||
|
|
|
||
|
|
diff --git a/include/exiv2/value.hpp b/include/exiv2/value.hpp
|
||
|
|
index 2078c6bd..b7d76fef 100644
|
||
|
|
--- a/include/exiv2/value.hpp
|
||
|
|
+++ b/include/exiv2/value.hpp
|
||
|
|
@@ -1659,11 +1659,13 @@ namespace Exiv2 {
|
||
|
|
ok_ = true;
|
||
|
|
return static_cast<long>(value_[n]);
|
||
|
|
}
|
||
|
|
+// #55 crash when value_[n].first == LONG_MIN
|
||
|
|
+#define LARGE_INT 1000000
|
||
|
|
// Specialization for rational
|
||
|
|
template<>
|
||
|
|
inline long ValueType<Rational>::toLong(long n) const
|
||
|
|
{
|
||
|
|
- ok_ = (value_[n].second != 0 && INT_MIN < value_[n].first && value_[n].first < INT_MAX );
|
||
|
|
+ ok_ = (value_[n].second != 0 && -LARGE_INT < value_[n].first && value_[n].first < LARGE_INT);
|
||
|
|
if (!ok_) return 0;
|
||
|
|
return value_[n].first / value_[n].second;
|
||
|
|
}
|
||
|
|
@@ -1671,7 +1673,7 @@ namespace Exiv2 {
|
||
|
|
template<>
|
||
|
|
inline long ValueType<URational>::toLong(long n) const
|
||
|
|
{
|
||
|
|
- ok_ = (value_[n].second != 0);
|
||
|
|
+ ok_ = (value_[n].second != 0 && value_[n].first < LARGE_INT);
|
||
|
|
if (!ok_) return 0;
|
||
|
|
return value_[n].first / value_[n].second;
|
||
|
|
}
|
||
|
|
diff --git a/src/basicio.cpp b/src/basicio.cpp
|
||
|
|
index 95589cd2..f2e1518b 100644
|
||
|
|
--- a/src/basicio.cpp
|
||
|
|
+++ b/src/basicio.cpp
|
||
|
|
@@ -990,6 +990,7 @@ namespace Exiv2 {
|
||
|
|
DataBuf FileIo::read(long rcount)
|
||
|
|
{
|
||
|
|
assert(p_->fp_ != 0);
|
||
|
|
+ if ( (size_t) rcount > size() ) throw Error(57);
|
||
|
|
DataBuf buf(rcount);
|
||
|
|
long readCount = read(buf.pData_, buf.size_);
|
||
|
|
buf.size_ = readCount;
|
||
|
|
diff --git a/src/error.cpp b/src/error.cpp
|
||
|
|
index 80378c19..e90a9c0a 100644
|
||
|
|
--- a/src/error.cpp
|
||
|
|
+++ b/src/error.cpp
|
||
|
|
@@ -106,6 +106,9 @@ namespace {
|
||
|
|
{ 52, N_("%1 has invalid XMP value type `%2'") }, // %1=key, %2=value type
|
||
|
|
{ 53, N_("Not a valid ICC Profile") },
|
||
|
|
{ 54, N_("Not valid XMP") },
|
||
|
|
+ { 55, N_("tiff directory length is too large") },
|
||
|
|
+ { 56, N_("invalid type value detected in Image::printIFDStructure") },
|
||
|
|
+ { 57, N_("invalid memory allocation request") },
|
||
|
|
};
|
||
|
|
|
||
|
|
}
|
||
|
|
diff --git a/src/image.cpp b/src/image.cpp
|
||
|
|
index 0d828045..ec5b873e 100644
|
||
|
|
--- a/src/image.cpp
|
||
|
|
+++ b/src/image.cpp
|
||
|
|
@@ -399,7 +399,13 @@ namespace Exiv2 {
|
||
|
|
;
|
||
|
|
|
||
|
|
// if ( offset > io.size() ) offset = 0; // Denial of service?
|
||
|
|
- DataBuf buf(size*count + pad+20); // allocate a buffer
|
||
|
|
+
|
||
|
|
+ // #55 memory allocation crash test/data/POC8
|
||
|
|
+ long long allocate = (long long) (size*count + pad+20);
|
||
|
|
+ if ( allocate > (long long) io.size() ) {
|
||
|
|
+ throw Error(57);
|
||
|
|
+ }
|
||
|
|
+ DataBuf buf(allocate); // allocate a buffer
|
||
|
|
std::memcpy(buf.pData_,dir.pData_+8,4); // copy dir[8:11] into buffer (short strings)
|
||
|
|
if ( count*size > 4 ) { // read into buffer
|
||
|
|
size_t restore = io.tell(); // save
|